topic Incorrect Rule Assignment UrlCategory Any in General Topics

Incorrect Rule Assignment UrlCategory Any

fhewiufhwefhwe — Fri, 17 Jul 2020 13:42:26 GMT

External ipaddress 23.35.182.93 is getting incorrectly mapped to a rule "Permit Intranet Sites".

The rule uses a Urlcategory for Intranet sites and the destination has trust/untrust zones with a negate on one specific destination address.

What might cause the firewall to misapply rules if the dns to ipaddress mappings are effectively static?

I also have noticed on more than a few instances of policies with UrlCategory being applied incorrectly, many of which are external ipaddresses.

Re: Incorrect Rule Assignment UrlCategory + Negate Destination

nbutter — Thu, 16 Jul 2020 18:10:18 GMT

URL filtering != FQDN. URL filtering is looking at what's in the packet headers, FQDN is permitting based on the resolved IP address.

If you make the question more tangible I can try and give a specific answer.

Have a good day,

Re: Incorrect Rule Assignment UrlCategory + Negate Destination

fhewiufhwefhwe — Thu, 16 Jul 2020 19:10:21 GMT

You can create custom objects -> URL Category, which can contain FQDNs and static ipaddresses. This is necessary to prevent URL Filtering from interfering with some sites.

Re: Incorrect Rule Assignment UrlCategory Any

fhewiufhwefhwe — Tue, 28 Jul 2020 20:06:30 GMT

Solved by upgrading to 9.1 from 9.0 PanOS

Re: Incorrect Rule Assignment UrlCategory Any

fhewiufhwefhwe — Tue, 28 Jul 2020 21:29:02 GMT

Spoke too soon. This is actually unsolved. After two days, got first counterexample showing it didn't work.